T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/run_web_extract.mjs:161
- Finding
- Bearer API Credential Can Be Redirected to an Arbitrary Endpoint## Vulnerability Details **File Location**: `scripts/run_web_extract.mjs:161, 177-190` **Vulnerability Type**: Unrestricted credential-bearing endpoint override **Risk Level**: High **Vulnerable Code**: ```javascript const apiBase = (process.env.FELO_API_BASE?.trim() || DEFAULT_API_BASE).replace(/\/$/, ''); const shortUrl = args.url.length > 45 ? args.url.slice(0, 42) + '...' : args.url; const spinnerId = startSpinner(`Fetching ${shortUrl}`); try { const body = { url: args.url, output_format: args.format, crawl_mode: args.crawlMode, with_readability: args.readability, timeout: args.timeoutMs, }; if (args.targetSelector) body.target_selector = args.targetSelector; if (args.waitForSelector) body.wait_for_selector = args.waitForSelector; const payload = await fetchJson( `${apiBase}/v2/web/extract`, { method: 'POST', headers: { Accept: 'application/json', Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json', }, ``` The corresponding endpoint override is documented in `SKILL.md:130`: ```markdown - **Base URL**: `https://openapi.felo.ai`. Override with `FELO_API_BASE` env if needed. ``` ### Technical Analysis The script reads `FELO_API_BASE` from the process environment without validating its URL scheme, hostname, port, or trust relationship. It then sends the value of `FELO_API_KEY` as a bearer credential to the resulting endpoint. The default network request to Felo is necessary for the declared hosted webpage-extraction functionality. The unrestricted endpoint override is not necessary for the standard workflow and exceeds the minimum trust boundary required by that functionality. It permits credential-bearing requests to arbitrary HTTPS hosts and even plaintext HTTP endpoints. Although exploitation requires influence over the process environment or launch configuration, such influence ma ...[truncated 1493 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `FELO_API_BASE` support if custom service endpoints are not an essential requirement. 2. If an override is required, parse it with the standard `URL` API and reject malformed values. 3. Require the `https:` scheme and reject plaintext HTTP, embedded credentials, fragments, and unexpected ports. 4. Restrict credential-bearing requests to an explicit hostname allowlist, preferably only `openapi.felo.ai`. 5. Do not forward the production `FELO_API_KEY` to custom endpoints. Require a distinct environment variable for non-Felo services. 6. Make custom endpoint use an explicit command-line opt-in and display the destination hostname before sending credentials. 7. Document that requested URLs and extraction parameters are sent to the remote provider. 8. Use narrowly scoped, revocable API keys and rotate any key that may have been sent to an untrusted endpoint.